7

Let's take an example, let's assume that I would allow only outgoing HTTP[S] traffic to pass through the firewall. I know I would also need to allow outgoing DNS traffic in a real world scenario, but this is just an example. I would have written the iptable rules like this:

:INPUT DROP
:FORWARD DROP
:OUTPUT DROP

-A INPUT -p tcp -m multiport --sports 80,443 -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -p tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Is this correct? I wonder because I have seen people who have written the same firewall rules like this:

:INPUT DROP
:FORWARD DROP
:OUTPUT DROP

-A INPUT -p tcp -m multiport --sports 80,443 -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -p tcp -m multiport --dports 80,443 -m state --state NEW -j ACCEPT

What is the difference between NEW and NEW,ESTABLISHED,RELATED for an outgoing rule? Is it enough just to write NEW and let the firewall do some mysterious magic? Or is it necessary to write NEW,ESTABLISHED,RELATED?

1
  • As a note, the line is most commonly written this way: -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT. This change essentially turns iptables into a stateful firewall. Instead of having to define each TCP connection properly, this line essentially allows all traffic that has already been processed (and allowed) by iptables.
    – prateek61
    Jun 28, 2016 at 2:44

1 Answer 1

4

The second configuration will not work (try it!). Since your default policy is DROP on the OUTPUT chain, the third packet of the TCP three-way-handshake will be blocked by the firewall, as that one does not fall under NEW, so the connection will never be established.

It would work if your default OUTPUT policy would be ACCEPT, or you had some other OUTPUT rule afterwards which would allow ESTABLISHED and RELATED state.

In conclusion, the first ruleset is the correct one, if you want to have DROP as your default policy.

1
  • Thanks for the answer. That was what I thought, but i got a little bit confused when I saw someone write it with only NEW. I thought maybe IPtables creates some sort of records of established connection, and it was then unecessary to use ESTABLISHED. Jul 14, 2015 at 13:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .